---
typeId: req
recordId: benac-auth-014
fields:
  title: Authentication expiry and revocation
  statement: Benac shall support authentication/session expiry, credential
    revocation metadata, failed authentication records, and failure-closed
    behavior for expired, missing, revoked, malformed, replayed, or invalid
    authentication.
  rationale: Authentication must be accountable over time and cannot be treated as
    permanent once observed.
  verification: Expire or revoke an authenticated session or credential and verify
    that subsequent authority-bearing operations fail or require fresh
    authentication.
  testable: true
  status: draft
  area: BENAC-AUTH
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.2 Authentication and authority boundaries
  order: 29
---
